Oracle WebCenter Portal CVE-2026-60729

The attacker must hold a low-privileged authenticated account on the target Oracle WebCenter Portal instance, as indicated by PR:L in the CVSS vector - fully unauthenticated exploitation is not supported by available data. Beyond that credential requirement, Oracle describes the vulnerability as 'easily exploitable' with low attack complexity (AC:L) and no user interaction (UI:N), indicating that no special non-default configuration, specific portal feature enablement, or victim action is required to reach the vulnerable Composer code path. Network access to the portal's HTTP interface is required (AV:N). The exploitable surface is limited to the Composer component specifically. Exploitation is bounded by: the need for at least one valid (even low-privilege) portal user account, and the unchanged scope (S:U) which does not directly facilitate lateral movement to other Fusion Middleware components via this vulnerability alone.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 and accurately reflects a high-severity, easily exploitable vulnerability: network-accessible, low attack complexity, only low-level authentication required, no user interaction, and complete CIA impact. Oracle's explicit characterization of the flaw as 'easily exploitable' reinforces the AC:L and UI:N metrics and suggests minimal barrier to exploitation once credentials are obtained. The full-takeover outcome is the most severe possible for a single application target. EPSS probability data is not available in the provided intelligence. The vulnerability is not listed in CISA KEV and no public POC has been identified at time of analysis, so confirmed active exploitation cannot be stated. Despite this, the risk profile is high for any organization running affected versions - low privilege and low complexity together mean any portal user account is a potential attack vector. The 'Information Disclosure' tag from the reporting source understates the actual impact, which the CVSS vector clearly describes as a full-triad compromise. The unchanged scope (S:U) limits direct lateral movement to adjacent systems via this vulnerability alone, but full application takeover of a portal hosting sensitive organizational data carries significant secondary risk.

A low-privileged attacker - for example, a standard portal contributor, self-registered user, or internally provisioned business account - sends a specially crafted HTTP request to the Composer component of an internet- or intranet-facing Oracle WebCenter Portal instance. With low attack complexity and no user interaction required, the attacker triggers the vulnerable code path and achieves full takeover of the portal, gaining control over portal content, stored data, and application-level resources across all affected versions.